Every company relies on vendors that process personal data in different ways. Some support core product or service functions, some store data, and others access sensitive systems. Vendors that process customer data on a company's behalf in delivering its services are sub-processors. Managing them properly is essential to meeting contractual and privacy obligations and maintaining customer trust.
The basics: what ...
Transparency regarding the use of artificial intelligence (AI) and human oversight over AI outputs – these are some of the new duties imposed by the Israeli Supreme Court’s recent landmark decision on artificial intelligence (Administrative Appeal 63194-08-25 Cohen v. Ramat Gan Municipality et al. (March 23, 2026)). The decision was delivered on an appeal filed by a father of ...
Earlier this month, the Israeli Privacy Protection Authority (PPA) imposed a monetary sanction of NIS 256,000 (approximately USD 83,000) on Meuhedet Health Maintenance Organization (HMO) for failing to report a severe security incident immediately, as required by the Protection of Privacy Law and, specifically, the Protection of Privacy (Data Security) Regulations. The significance of the sanction lies not only in ...
The Digital Operational Resilience Act (DORA) became effective on January 17, 2025, significantly impacting any supplier of technology to the financial sector in the European Union (EU), regardless of their location.
This EU regulation represents a major shift aimed at ensuring that financial institutions are resilient to operational disruptions, particularly those stemming from ICT (Information and Communication Technology) vulnerabilities. DORA ...
A new European Product Liability Directive (the “PLD”) now applies to digital and AI-based products. It replaces its predecessor from 1985. The PLD defines rules of evidence and liability for compensation for property damage, personal injury, and data loss. It applies to any company in the supply chain of software and artificial intelligence (AI) systems to the European Union market, ...
Myth: "We're GDPR compliant". Reality: You're probably not.
The GDPR is a regulation, not a certification. A closer look at the GDPR's provisions will show that there is room for controllers and processors to adjust requirements to their operations and activities. This is not a coincidence. The GDPR is meant to apply broadly. At its core, it assumes that ...
Privacy laws in Israel and abroad require data controllers to enter into data processing addendums with their processors whenever those processors are given access to the controllers personal data.
In Israel, the obligation is based on Regulation 15 of the Protection of Privacy (Data Security) Regulations (and on the Privacy Protection Authority's guidance on the use of outsourcing services for processing ...
New user? Click here to register